I’m using a PreAuthenticatedAuthenticationProvider in a AbstractPreAuthenticatedProcessingFilter but didn’t declare a bean for AuthenticationManager.class, AuthenticationProvider.class, UserDetailsService.class.class or AuthenticationManagerResolver.class; didn’t want these to be configurable in my case.

I use an AuthenticationUserDetailsService and only need to have this configurable so I declare a bean for this class.

I’m building an custom autoconfiguration module for my app so my code will be used as a dependency in my app.

When I start the app the UserDetailsServiceAutoConfiguration is loaded and the InMemoryUserDetailsManager bean is created (loggin some security warnings), which I don’t want.

I know I can disable it using spring:autoconfigure:exclude but this would be in the application.yaml of the app and I need a solution to do it in my autoconfiguration module.

So, my question is: Should UserDetailsServiceAutoConfiguration have also AuthenticationUserDetailsService in the ConditionalOnMissingBean ?

If not why?
IS there any other way to achieve what I need to do?

One way to do it is to add the following bean:

  @Bean
  @ConditionalOnMissingBean
  public UserDetailsService userDetailsService() {
    // dummy user details service
    return username -> new User(username, "N/A", emptyList());
  }

But this it’s just a workaround to avoid the default UserDetailsService to be created and it doesn’t avoid the UserDetailsServiceAutoConfiguration to be loaded.